1

So my real problem is that today I've suddenly been having issues with entry processes and IOPS far exceeding the hosting account limits and causing my site to go down. I've never even gotten close to reaching these limits in the past, and nothing has changed. So this has lead me to review the Awstats to see if I can find out what's going on, and I've found some strange things.

I've found a few things that look abnormal, but the strangest thing is that under the "Locales" section it's showing 9,400 hits using only 8.4MB of bandwidth, and under the "Hosts" section, I've got one IP showing over 7,000 hits using only 23KB of bandwidth, and another with 1,300 hits using 0 bandwidth.

I don't know a ton about this stuff, but from what I've read this seems abnormal. I've been searching around to see if anyone else has experience hits without bandwidth and I can't find any information on that.

I am thinking that this might have something to do with the resource usage issues I'm having. I'm hoping someone here can shed some more light on this for me, as my searches have not brought me anything useful.

Improve this question
5
  • Sounds like a bot attack. Cloudflare sent out notices today about widespread DDoS attacks across its network trying to solicit ransomware payments, demonstrating short lived DDoS attacks as proof that they'll occur. Try to add the IP's to a firewall rule, ModSecurity, or other similar blacklist. It might be a good idea to backup any sensitive data just in case.
    – dan ♦
    Commented Oct 17, 2020 at 5:02
  • 1
    Thanks for the info @dan! As I went to block the IP addresses, I realized that the IP responsible for the 7,000 hits (using only 23KB of bandwidth) is actually the shared IP address for the server. I feel so dumb for not seeing that sooner. But now I have no idea that means at this point?
    – JLW
    Commented Oct 17, 2020 at 16:26
  • It's hard to tell, any account or application on the server could be using a socket to connect to your site and request small amounts of data. That might suggest malware, or it could be just an application or script that's misconfigured... If you can run top or ps you might be able to spot the process (see this). Otherwise I'd suggest contacting support for your shared hosting. They'll be able to see CPU spikes for all the processes on that server for all the other users. Good luck!
    – dan ♦
    Commented Oct 17, 2020 at 17:11
  • 1
    @dan, okay I will have to do some more digging to get to the bottom of it. Thank you for pointing me in the right direction!
    – JLW
    Commented Oct 19, 2020 at 21:20
  • looks like bot traffic as dan suggested, you might want to check request type accessed as well, sometimes bots just need HEAD to get the information they need and I think it would have low footprint
    – Manoj Purohit
    Commented Dec 14, 2021 at 8:06

1 Answer 1

Reset to default
1

You need to set up a firewall in WordPress blocking some country's access to your site example china. I had that problem before. you will filter them by country.

Improve this answer
1
  • I don't think blocking countries is an option for me, because the problematic countries listed in the Awstats are countries that need to access my site.
    – JLW
    Commented Oct 19, 2020 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.